# O-UNC-066 ("Pink") Abuses Microsoft Entra Passkey Enrollment via Live-Operator Phone Phishing to Hijack Enterprise Accounts

> Since April 2026, threat actor O-UNC-066 (Okta) / CL-CRI-1147 (Palo Alto Networks Unit 42), operating a data-leak site named "Pink", has run live-operator vishing campaigns that trick employees into completing what appears to be Microsoft Entra passkey enrollment. Real-time operators relay victims' genuine MFA challenges to authenticate as the victim, then register an attacker-controlled passkey for persistent, password-reset-resistant access, followed by exfiltration of SharePoint/OneDrive data for extortion.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1186
- **ID:** TL-2026-1186
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** O-UNC-066
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

O-UNC-066, publicly branded "Pink" on its data-leak site (launched 2026-05-31) and tracked by Palo Alto Networks Unit 42 as CL-CRI-1147, is a financially motivated extortion group assessed to be affiliated with the decentralized cybercrime collective known as "The Com", the same loose network associated with Scattered Spider, ShinyHunters, and LAPSUS$. Since April 2026 the group has run a live-operator, phone-based social engineering (vishing) campaign against enterprise employees, using Microsoft's 2026 default rollout of passkey-enrollment "nudge" prompts as a pretext.

A caller impersonating IT support tells the target that a new Microsoft Entra passkey must be registered for security reasons and directs them to a phishing URL on an attacker-registered domain containing the word "passkey" (e.g. setpasskey[.]com), using a per-target subdomain ("[target-entity].[base-domain]") customized with the victim organization's real branding to look like a legitimate Entra enrollment portal.

The phishing kit is not a transparent adversary-in-the-middle (AitM) reverse proxy; it is an operator-controlled PHP panel that polls for instructions roughly once per second, letting a live human operator decide in real time which fake screen the victim sees next. The kit walks the victim through: an anti-analysis gate (/gate), username capture (/identify), password capture (/password, POSTed to a backend operator panel at /backend.php), a stalling "processing" screen (/processing) while the operator uses the stolen credentials to authenticate to the real Microsoft tenant, and then adaptive MFA-capture screens matched to whatever factor the real login actually prompts for: SMS OTP (/submit-otp), TOTP (/submit-authenticator), or push/number-matching approval (/approve-authenticator). Because the operator observes the real authentication flow and requests the matching code or approval from the victim, this functions as real-time MFA interception/relay rather than a bypass of any MFA weakness.

Once the operator has completed the real login, they use the legitimate Microsoft interface to register their own passkey against the victim's account. To keep the victim from noticing, the kit simultaneously displays a fake passkey-registration flow to the victim, including an arbitrary BIP-39-style "recovery seed phrase" that has no cryptographic relationship to Microsoft Entra passkeys and exists purely as a distraction (/passkey/register, /passkey, /passkey/check), before showing a false success page (/done). The victim believes they personally completed a routine security upgrade, and legitimate Microsoft notification emails about the new passkey are frequently dismissed as expected. Because passkeys are device-bound credentials independent of the password, the attacker-registered passkey survives a subsequent password reset, giving durable persistent access.

Post-compromise, Pink actors move quickly to collect and exfiltrate data from the victim's SharePoint and OneDrive services, then use the data-leak site to pressure victims into paying extortion demands rather than deploying ransomware. Observed targeting spans food and beverage, technology, healthcare, automotive, construction, and aviation organizations. The kit does not redirect through third-party identity providers, so organizations that route Microsoft 365 authentication through external IdP federation have not shown signs of direct compromise via this specific kit. There is no associated CVE — this is an identity/social-engineering abuse of a legitimate product feature (Entra passkey self-service enrollment), not a software vulnerability.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1591 Gather Victim Org Information
- T1583.001 Domains
- T1583.004 Server
- T1608.005 Link Target
- T1566.004 Spearphishing Voice
- T1684.001 Impersonation
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1552 Unsecured Credentials
- T1078 Valid Accounts
- T1098.005 Device Registration
- T1078.004 Cloud Accounts
- T1526 Cloud Service Discovery
- T1213.002 Sharepoint
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Hackers Abuse Microsoft Entra Passkey Enrollment to Hijack Enterprise Accounts](https://cybersecuritynews.com/hackers-abuse-microsoft-entra-passkey-enrollment/)
- [Vishing actors target Microsoft Entra passkey enrollment](https://www.okta.com/blog/threat-intelligence/vishing-actors-target-microsoft-entra-passkey-enrollment-/)
- [Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access](https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html)
- [Entra passkey enrollment vishing targets Microsoft 365 users](https://www.bleepingcomputer.com/news/security/entra-passkey-enrollment-vishing-targets-microsoft-365-users/)
- [Pink is the latest goon squad to use fake helpdesk calls to steal creds](https://www.theregister.com/cyber-crime/2026/06/04/pink-is-the-latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds/5251434)
- [O-UNC-066 Vishing Targets Microsoft Entra Passkey Enrollment](https://www.technadu.com/o-unc-066-vishing-campaign-abuses-microsoft-entra-passkey-enrollment/630640/)
- [Microsoft Entra Passkey Enrollment Abused in Operator-Controlled Vishing Campaign](https://gbhackers.com/microsoft-entra-passkey-enrollment/)
- [Fake Microsoft Passkey Flow Uses BIP-39 Seed Phrase Distraction During Account Takeover](https://cyberpress.org/fake-passkey-steals-accounts/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1186